scamscript 0.6.1__tar.gz → 0.8.0__tar.gz

{scamscript-0.6.1 → scamscript-0.8.0}/CHANGELOG.md

@@ -5,6 +5,40 @@ schema are the things that count as public API.
 
 ## Unreleased
 
+## 0.8.0 - 2026-11-02
+
+### Added
+
+- `channel` field (`vishing`, `smishing`, `email`, `other`) separate from the attack theme, with
+  `--channel` filtering in reports and briefings.
+- `brief --html`: self-contained printable page, escaped and offline.
+
+### Changed
+
+- Panels show the channel; JSON records carry it; real-corpus validation confirms text lures keep
+  their delivery route.
+
+## 0.7.0 - 2026-11-02
+
+### Added
+
+- `brief` command: a one-page defence handout per type from a finished run.
+- `--language` override and stopword language detection; the prompt asks for the script's own language.
+- `corpus/real/` with ten published transcripts, provenance in every header, and `docs/real-corpus.md`.
+- `--force` before overwriting an output file.
+
+### Fixed
+
+- Apostrophes inside words (`target's`) were read as quote delimiters, producing false `missing`
+  verdicts. Long quotes are now checked clause by clause.
+- A recursive walk followed a symlink loop; it now terminates.
+- A file changing mid-read is reported instead of being half-analyzed.
+- Utility-rebate robocalls classified as `refund`; utility is matched first.
+
+### Changed
+
+- Default `--max-tokens` 4096 → 6144, after two real calls hit the ceiling on the first attempt.
+
 ## 0.6.1 - 2026-11-02
 
 ### Changed

{scamscript-0.6.1 → scamscript-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scamscript
-Version: 0.6.1
+Version: 0.8.0
 Summary: Reverse-engineer scam scripts and vishing transcripts into structured counter-playbooks
 Project-URL: Homepage, https://github.com/sjdsjadjajdjsa/scamscript
 Project-URL: Repository, https://github.com/sjdsjadjajdjsa/scamscript
@@ -111,7 +111,7 @@ Each script renders as a colour-coded panel:
 ╰────────────────────────────────── 7 red flags ───────────────────────────────╯
 ```
 
-Fields: `attack_type`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
+Fields: `attack_type`, `channel`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
 `escalation_ladder`, `target_demographics`, `red_flags`, `defense_summary`, `sophistication_score`.
 
 The panel also carries a **quote check**: every quoted claim in `opening_hook` and `red_flags` is
@@ -130,11 +130,12 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 | `batch <dir>` | Same as above, ranked |
 | `report --run-id` | Regenerate a report from a past run's log |
 | `history` | List previous runs |
+| `brief` | One-page defence handout from a finished run |
 | `prune` | Delete old logs |
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
 `--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--dedupe/--no-dedupe`,
-`--show-duplicates`, `--type`, `--no-color`. `--json` puts one object per script on stdout and all
+`--show-duplicates`, `--type`, `--channel`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -155,6 +156,17 @@ The cap reads `usage.cost` from the response, so it works only where the provide
 says so when none is sent. Spend is printed and logged per run. In-flight requests can overshoot by
 up to the concurrency, so keep headroom on a hard limit.
 
+## Real corpus
+
+`corpus/real/` holds ten published transcripts with source, date and verbatim status in every
+header: a 40-minute bank impersonation call, a Medicare benefits pitch, six FTC robocalls, a
+recalled credit-union call and a USPS smishing message. Provenance and the results of running them
+are in [`docs/real-corpus.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/real-corpus.md).
+
+```bash
+scamscript --redact batch corpus/real --concurrency 3 --max-cost 0.25 --output real.md
+```
+
 ## Attack types
 
 `attack_type` is free prose, which is useful to read and useless to group. Every result also carries a
@@ -166,6 +178,20 @@ per slug above the ranking, and `--type` filters to the ones you ask for:
 scamscript batch corpus/ --type tech-support,refund --output report.md
 ```
 
+Delivery is tracked separately from theme. `channel` is one of `vishing`, `smishing`, `email` or
+`other`, so a delivery-themed text lure is `delivery` + `smishing` rather than losing one of the two.
+`--channel` filters on it:
+
+```bash
+scamscript batch corpus/real --channel smishing --output texts.md
+```
+
+Briefings group by type but accept `--channel` too. Build one from a finished run:
+
+```bash
+scamscript brief --type tech-support --output briefing.md
+```
+
 The raw phrase is always kept next to the slug. An unrecognised description lands in `other` and the
 CLI names any filter token it did not recognise.
 
@@ -220,6 +246,21 @@ Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (o
 a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
 bounded. Directories are `0700` and log files `0600`.
 
+## Printable briefings
+
+`brief --html` writes a self-contained page with inline CSS and escaped text, for handing to people
+who will not open a terminal.
+
+```bash
+scamscript brief --type tech-support --html --output handout.html
+```
+
+## Paths
+
+`--file` and `--dir` resolve symlinks, a recursive walk survives a symlink loop, and a file that
+changes while it is read is an error rather than a half-read prompt. Output files are not overwritten
+unless `--force` is passed.
+
 ## Install and configure
 
 Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
@@ -281,6 +322,7 @@ src/scamscript/
   verify.py     quote checking against the source
 tests/          schema, retry, redaction, verification, client and CLI tests
 examples/       six fictional transcripts, plus adversarial/ fixtures
+corpus/real/    ten published transcripts with provenance
 scripts/        calibration and injection harnesses
 docs/           calibration record, sample report, banner, demo
 ```
@@ -293,7 +335,10 @@ docs/           calibration record, sample report, banner, demo
 - Duplicate folding ignores formatting only; a single changed digit keeps a copy separate.
 - Type slugs are keyword-matched, so an unusual description falls to `other` rather than inventing one.
 - The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
-- Analysis is English-centric: the prompt and schema assume English artifacts.
+- `channel` is inferred from the model's answer or, failing that, from keywords; a script with no
+  channel words falls to `other`.
+- The prompt asks the model to answer in the script's own language and `--language` overrides
+  detection, but the type keywords are English: a non-English script often falls to `other`.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
   an accurate paraphrase without quotes is skipped rather than judged.
 

{scamscript-0.6.1 → scamscript-0.8.0}/README.md

@@ -75,7 +75,7 @@ Each script renders as a colour-coded panel:
 ╰────────────────────────────────── 7 red flags ───────────────────────────────╯
 ```
 
-Fields: `attack_type`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
+Fields: `attack_type`, `channel`, `persona`, `opening_hook`, `trust_building_moves`, `urgency_tactics`,
 `escalation_ladder`, `target_demographics`, `red_flags`, `defense_summary`, `sophistication_score`.
 
 The panel also carries a **quote check**: every quoted claim in `opening_hook` and `red_flags` is
@@ -94,11 +94,12 @@ corpus is at [`docs/sample-report.md`](https://github.com/sjdsjadjajdjsa/scamscr
 | `batch <dir>` | Same as above, ranked |
 | `report --run-id` | Regenerate a report from a past run's log |
 | `history` | List previous runs |
+| `brief` | One-page defence handout from a finished run |
 | `prune` | Delete old logs |
 
 Useful flags: `--dry-run`, `--json`, `--redact`, `--top N`, `--recursive`, `--timeout`,
 `--retries`, `--max-tokens`, `--concurrency`, `--max-cost`, `--dedupe/--no-dedupe`,
-`--show-duplicates`, `--type`, `--no-color`. `--json` puts one object per script on stdout and all
+`--show-duplicates`, `--type`, `--channel`, `--language`, `--force`, `--no-color`. `--json` puts one object per script on stdout and all
 Rich output on stderr, so it pipes:
 
 ```bash
@@ -119,6 +120,17 @@ The cap reads `usage.cost` from the response, so it works only where the provide
 says so when none is sent. Spend is printed and logged per run. In-flight requests can overshoot by
 up to the concurrency, so keep headroom on a hard limit.
 
+## Real corpus
+
+`corpus/real/` holds ten published transcripts with source, date and verbatim status in every
+header: a 40-minute bank impersonation call, a Medicare benefits pitch, six FTC robocalls, a
+recalled credit-union call and a USPS smishing message. Provenance and the results of running them
+are in [`docs/real-corpus.md`](https://github.com/sjdsjadjajdjsa/scamscript/blob/master/docs/real-corpus.md).
+
+```bash
+scamscript --redact batch corpus/real --concurrency 3 --max-cost 0.25 --output real.md
+```
+
 ## Attack types
 
 `attack_type` is free prose, which is useful to read and useless to group. Every result also carries a
@@ -130,6 +142,20 @@ per slug above the ranking, and `--type` filters to the ones you ask for:
 scamscript batch corpus/ --type tech-support,refund --output report.md
 ```
 
+Delivery is tracked separately from theme. `channel` is one of `vishing`, `smishing`, `email` or
+`other`, so a delivery-themed text lure is `delivery` + `smishing` rather than losing one of the two.
+`--channel` filters on it:
+
+```bash
+scamscript batch corpus/real --channel smishing --output texts.md
+```
+
+Briefings group by type but accept `--channel` too. Build one from a finished run:
+
+```bash
+scamscript brief --type tech-support --output briefing.md
+```
+
 The raw phrase is always kept next to the slug. An unrecognised description lands in `other` and the
 CLI names any filter token it did not recognise.
 
@@ -184,6 +210,21 @@ Every request appends to a timestamped JSONL file under `~/.scamscript/logs/` (o
 a run replays without spending tokens, and `prune --keep 200 --keep-days 30` keeps the store
 bounded. Directories are `0700` and log files `0600`.
 
+## Printable briefings
+
+`brief --html` writes a self-contained page with inline CSS and escaped text, for handing to people
+who will not open a terminal.
+
+```bash
+scamscript brief --type tech-support --html --output handout.html
+```
+
+## Paths
+
+`--file` and `--dir` resolve symlinks, a recursive walk survives a symlink loop, and a file that
+changes while it is read is an error rather than a half-read prompt. Output files are not overwritten
+unless `--force` is passed.
+
 ## Install and configure
 
 Python 3.12+. `pip install scamscript` for use, `pip install -e ".[dev]"` from a clone for tests.
@@ -245,6 +286,7 @@ src/scamscript/
   verify.py     quote checking against the source
 tests/          schema, retry, redaction, verification, client and CLI tests
 examples/       six fictional transcripts, plus adversarial/ fixtures
+corpus/real/    ten published transcripts with provenance
 scripts/        calibration and injection harnesses
 docs/           calibration record, sample report, banner, demo
 ```
@@ -257,7 +299,10 @@ docs/           calibration record, sample report, banner, demo
 - Duplicate folding ignores formatting only; a single changed digit keeps a copy separate.
 - Type slugs are keyword-matched, so an unusual description falls to `other` rather than inventing one.
 - The cost cap depends on provider-reported usage and can overshoot by the in-flight count.
-- Analysis is English-centric: the prompt and schema assume English artifacts.
+- `channel` is inferred from the model's answer or, failing that, from keywords; a script with no
+  channel words falls to `other`.
+- The prompt asks the model to answer in the script's own language and `--language` overrides
+  detection, but the type keywords are English: a non-English script often falls to `other`.
 - Quote checking compares text, not meaning. A legitimate paraphrase left in quotes is flagged;
   an accurate paraphrase without quotes is skipped rather than judged.